Trivela is committed to maintaining the highest security standards for financial safety, reserve integrity, smart contract execution, and backend data protection. We operate a formal bug bounty program and deeply appreciate responsible vulnerability disclosure from security researchers.
| Component / Branch | Supported Versions | Security Status |
|---|---|---|
main (Production Branch) |
Current Release | ✅ Active Security Maintenance |
Soroban Contracts (/contracts/, /soroban/) |
>= 0.8.0 |
✅ Active Audit & Hotfix Coverage |
Backend Services (/backend/) |
>= 1.0.0 |
✅ Active Security Maintenance |
Client SDK & Frontend (/sdk/, /frontend/) |
Current Release | ✅ Active Security Maintenance |
| Legacy / Deprecated Branches | Prior Releases | ❌ Unsupported (Upgrade Required) |
If you discover a security vulnerability in Trivela, please report it responsibly. Do NOT open a public GitHub issue or pull request before the vulnerability is resolved.
- GitHub Private Security Advisory: Open a private draft at Trivela Security Advisories.
- Encrypted Security Email: Contact the security team at
security@finessestudiolab.comwith subject line[SECURITY DISCLOSURE] <Component/Title>.
To help us triage and validate your report swiftly, please provide:
- Detailed description of the vulnerability and its potential attack vector.
- Step-by-step reproduction instructions or a minimal reproducible Proof of Concept (PoC).
- Impact assessment on funds, reserves, authentication tokens, or contract state.
- Suggested architectural remediation or defensive patch (if available).
We offer structured financial rewards for verified vulnerabilities based on CVSS v3.1 severity scores and financial impact on the ecosystem:
| Severity Tier | CVSS v3.1 Score | Impact Scope | Reward Tier (USD / Equivalent) |
|---|---|---|---|
| Critical | 9.0 – 10.0 |
Direct theft/drain of user/reserve funds, arbitrary contract balance takeover, critical auth bypass | $2,500 – $5,000+ |
| High | 7.0 – 8.9 |
Contract execution halt causing fund lockup, privilege escalation to admin/signer, sensitive credential leak | $1,000 – $2,500 |
| Medium | 4.0 – 6.9 |
Gas/rent exhaustion attacks, logic flaws bypassing defensive limits, unauthorized access to user metadata | $300 – $1,000 |
| Low / Informational | 0.1 – 3.9 |
Minor information disclosure, non-exploitable edge-case inconsistencies, defensive hardening | $100 – $300 |
- Smart contracts (
/contracts/,/soroban/) - Backend API and auth middleware (
/backend/) - SDK and cryptographic signing libraries (
/sdk/) - Frontend application boundaries (
/frontend/)
- Denial of Service (DoS/DDoS) targeting public endpoints without state corruption
- Social engineering, phishing, or physical attacks
- Issues in third-party RPC providers or external node infrastructure
Trivela will not pursue legal action against security researchers who report vulnerabilities in good faith and adhere to responsible disclosure principles.
- Initial Acknowledgment: Within 24 to 48 hours.
- Triage & Validation: Within 5 business days.
- Fix Deployment & Bounty Payout: Immediate post-validation and coordinated release.